CVE-2024-4671: Chromium V8 type confusion leading to remote code execution

TL;DR

A type confusion bug in Chrome's V8 JavaScript engine allowed attackers to corrupt memory through crafted JavaScript that triggered incorrect type assumptions in the Maglev JIT compiler's optimization passes. Exploited in-the-wild before patch deployment, enabling full browser sandbox escape when chained with other vulnerabilities.

Affected versions

• Google Chrome versions prior to 125.0.6422.60 (Stable channel)
• Chromium-based browsers (Edge, Brave, Opera) using vulnerable V8 versions
• Node.js versions 20.x and 21.x incorporating vulnerable V8 builds
• Electron applications bundled with affected Chromium versions

The vulnerability existed in the Maglev tier-2 optimizing compiler introduced in V8 11.0, affecting releases from mid-2023 through May 2024.

Root cause

The vulnerability originated in Maglev's type feedback mechanism during compilation of object property access patterns. Maglev performs speculative optimizations based on inline caches (ICs) that track object shapes and property types observed at runtime.

The specific flaw occurred in maglev-ir.cc where CheckedObjectToIndex node incorrectly assumed type stability after CheckMaps verification. When processing polymorphic property access on objects that transitioned between different map representations (e.g., SMI to HeapNumber), the compiler generated code that skipped necessary type guards.

The bug manifested when:

1. An object's hidden class transitioned during property access
2. Maglev cached the pre-transition type information
3. Subsequent accesses used stale type assumptions
4. Type confusion occurred between pointer and SMI representations

This allowed treating a double-precision float as a pointer (or vice versa), breaking V8's pointer tagging scheme where the lowest bit distinguishes SMI integers (bit=1) from pointers (bit=0).

Exploitation primitive

Attackers leveraged this to construct an addrof/fakeobj primitive pair:

Step 1 - Triggering the confusion: Craft objects that trigger map transitions during Maglev compilation, causing the compiler to emit code that reads a double array element but interprets the bits as a tagged pointer.

Step 2 - addrof primitive: Read an object reference as a double, revealing its heap address by extracting the pointer bits. This defeats ASLR for the V8 heap.

Step 3 - fakeobj primitive: Write attacker-controlled doubles that get interpreted as object pointers, allowing fabrication of fake JavaScript objects with arbitrary properties.

Step 4 - Arbitrary R/W: Create fake TypedArray objects with attacker-controlled backing store pointers, enabling arbitrary memory read/write throughout the renderer process.

Step 5 - Shellcode execution: Overwrite JIT code pages or function pointers to redirect control flow to attacker-controlled shellcode, typically followed by a sandbox escape exploit.

Proof-of-concept exploits appeared within 48 hours of patch publication, with observed in-the-wild usage in targeted attacks against high-value individuals.

Mitigation

Immediate actions:

• Update Chrome/Chromium to version 125.0.6422.60 or later
• Deploy browser updates through enterprise management tools (GPO, MDM)
• Update Electron applications to use Chromium 125+
• Patch Node.js installations to versions incorporating fixed V8 builds

Defense-in-depth measures:

• Enable site isolation to limit cross-origin exploitation impact
• Deploy browser exploit mitigations (V8 sandbox, MiraclePtr)
• Implement network-level JavaScript filtering for high-risk users
• Use browser isolation solutions (remote browsing) for sensitive workflows

Detection opportunities:

• Monitor for repeated JIT compilation patterns characteristic of heap spraying
• Detect unusual ArrayBuffer allocation patterns
• Alert on renderer process crashes with access violations in JIT regions

Organizational response:

• Audit Electron and Node.js applications for vulnerable V8 versions
• Test compatibility of V8 updates in custom JavaScript engines
• Review incident logs for indicators of pre-patch exploitation

The rapid exploitation timeline underscores the critical importance of immediate browser patching, particularly for organizations handling sensitive data or high-risk user populations.